Misc

Miscelanueous plugins not yet categorized.

amsi

Function

AMSI is an interface on windows to scan a string for malware. This function submits the string to the AMSI system and receives a determination if it is malware.

Arg	Description	Type
string	A string to scan	string (required)

atexit

Function

Install a query to run when the query is unwound. This is used to clean up when the query ends.

For example:

LET _ <= atexit(query={
  SELECT rm(filename="Foobar.txt") FROM scope()
})

Arg	Description	Type
query	A VQL Query to parse and execute.	Any (required)
env	A dict of args to insert into the scope.	ordereddict.Dict
timeout	How long to wait for destructors to run (default 60 seconds).	uint64

column_filter

Plugin

Select columns from another query using regex.

Sometimes a query produces a large number of columns or unpredictable column names (eg. the read_reg_key() plugin produces a column per value name).

You can use the column_filter() plugin to select a subset of the columns to include or exclude from an underlying query. For example:

SELECT * FROM column_filter(
query={
   SELECT 1 AS A, 2 AS B, 3 AS AB, 4 AS AA
   FROM scope()
}, include="A", exclude="B")

will include columns with the letter A in their name and remove columns with the letter B (so it will have A and AA above).

Arg	Description	Type
query	This query will be run to produce the columns.	StoredQuery (required)
exclude	One of more regular expressions that will exclude columns.	list of string
include	One of more regular expressions that will include columns.	list of string

gcs_pubsub_publish

Function

Publish a message to Google PubSub.

Arg	Description	Type
topic	The topic to publish to	string (required)
project_id	The project id to publish to	string (required)
msg	Message to publish to Pubsub	Any (required)
credentials	The credentials to use	string (required)

geoip

Function

Lookup an IP Address using the MaxMind GeoIP database. You can get a copy of the database from https://www.maxmind.com/. The database must be locally accessible so this probably only makes sense on the server.

Arg	Description	Type
ip	IP Address to lookup.	string (required)
db	Path to the MaxMind GeoIP Database.	string (required)

import_collection

Function

Imports an offline collection zip file (experimental).

Offline collectors are preconfigure Velociraptor binaries that collect specific artifacts into a zip file.

This function allows such a collection to be imported into the GUI as if it was collected by the server. The collection will be loaded into a client’s filestore directory.

Since there is no actual client id associated with the offline collection (there is no Velociraptor client running on the endpoint) we generate a random client ID for a new client.

If you specify an existing client id, the collection will be uploaded into that client.

NOTE: Combine this function with the hunt_add() function to add a manual offline collection to an ongoing hunt.

Arg	Description	Type
client_id	The client id to import to. Use ‘auto’ to generate a new client id.	string (required)
hostname	When creating a new client, set this as the hostname.	string
filename	Path on server to the collector zip.	string (required)
accessor	The accessor to use	string

parse_pkcs7

Function

Parse a DER encoded pkcs7 string into an object.

Arg	Description	Type
data	PKCS7 DER encoded string.	string (required)

parse_x509

Function

Parse a DER encoded x509 string into an object.

Arg	Description	Type
data	X509 DER encoded string.	string (required)

parse_yaml

Function

Parse yaml into an object.

Arg	Description	Type
filename	Yaml Filename	string (required)
accessor	File accessor	string

query

Plugin

Evaluate a VQL query.

Arg	Description	Type
query	A VQL Query to parse and execute.	string (required)
env	A dict of args to insert into the scope.	ordereddict.Dict

range

Plugin

Iterate over range.

Arg	Description	Type
start	Start index (0 based)	int64 (required)
end	End index (0 based)	int64 (required)
step	End index (0 based)	int64 (required)

reg_rm_key

Function

Removes a key and all its values from the registry.

Arg	Description	Type
path	Registry key path.	string (required)

reg_rm_value

Function

Removes a value in the registry.

Arg	Description	Type
path	Registry value path.	string (required)

reg_set_value

Function

Set a value in the registry.

Arg	Description	Type
path	Registry value path.	string (required)
value	Value to set	LazyExpr (required)
type	Type to set (SZ, DWORD, QWORD)	string (required)
create	Set to create missing intermediate keys	bool

relpath

Function

Return the relative path of .

Arg	Description	Type
path	Extract directory name of path	string (required)
base	The base of the path	string (required)
sep	Separator to use (default native)	string

rm

Function

Remove a file from the filesystem using the API.

Arg	Description	Type
filename	Filename to remove.	string (required)

send_event

Function

Sends an event to a server event monitoring queue.

This is used to send an event to a waiting server event monitoring artifact (either as a VQL query running on the server or perhaps an external program waiting for this event via the API.

Arg	Description	Type
artifact	The artifact name to send the event to.	string (required)
row	The row to send to the artifact	ordereddict.Dict (required)

slice

Function

Slice an array.

Arg	Description	Type
list	A list of items to slice	Any (required)
start	Start index (0 based)	uint64 (required)
end	End index (0 based)	uint64 (required)

sql

Plugin

Run queries against sqlite, mysql, and postgres databases

Arg	Description	Type
driver	sqlite, mysql,or postgres	string (required)
connstring	SQL Connection String	string
file	Required if using sqlite driver	string
accessor	The accessor to use if using sqlite	string
query		string (required)
args		Any

starl

Function

Compile a starlark code block - returns a module usable in VQL

Arg	Description	Type
code	The body of the starlark code.	string (required)
key	If set use this key to cache the Starlark code block.	string
globals	Dictionary of values to feed into Starlark environment	Any

substr

Function

Create a substring from a string

Arg	Description	Type
str	The string to shorten	string (required)
start	Beginning index of substring	int
end	End index of substring	int

sum

Function

Sums the items.

Arg	Description	Type
item		int64 (required)

timeline

Plugin

Read a timeline. You can create a timeline with the timeline_add() function

Arg	Description	Type
timeline	Name of the timeline to read	string (required)
skip	List of child components to skip	list of string
start	First timestamp to fetch	Any
notebook_id	The notebook ID the timeline is stored in.	string

timeline_add

Function

Add a new query to a timeline.

Arg	Description	Type
timeline	Supertimeline to add to	string (required)
name	Name of child timeline	string (required)
query	Run this query to generate the timeline.	StoredQuery (required)
key	The column representing the time.	string (required)
notebook_id	The notebook ID the timeline is stored in.	string

unhex

Function

Apply hex decoding to the string.

Arg	Description	Type
string	Hex string to decode	string

unzip

Plugin

Unzips a file into a directory

Arg	Description	Type
filename	File to unzip.	string (required)
accessor	The accessor to use	string
filename_filter	Only extract members matching this filter.	string
output_directory	Where to unzip to	string (required)

upload_directory

Function

Upload a file to an upload directory. The final filename will be the output directory path followed by the filename path.

Arg	Description	Type
file	The file to upload	string (required)
name	Filename to be stored within the output directory	string
accessor	The accessor to use	string
output	An output directory to store files in.	string (required)
mtime	Modified time to set the output file.	Any
atime	Access time to set the output file.	Any
ctime	Change time to set the output file.	Any
btime	Birth time to set the output file.	Any

user_create

Function

Creates a new user from the server, or updates their permissions or reset their password.

Arg	Description	Type
user		string (required)
roles		list of string (required)
password		string

user_delete

Function

Deletes a user from the server.

Arg	Description	Type
user		string (required)

whoami

Function

Returns the username that is running the query.

xor

Function

Apply xor to the string and key.

Arg	Description	Type
string	String to apply Xor	string (required)
key	Xor key.	string (required)